> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Curity to use the KMES for SSL

> Procedural instructions to configure Curity Identity Server to use KMES Series 3 for SSL/TLS key management.

This section covers the tasks to configure Curity for the KMES Series 3.

## Log in to the KMES from Curity

You must configure each run-time node to communicate with the HSM. This requires a PIN or password. You can provide this interactively on the command line during startup, directly on the command line as an argument, or in the environment variable `IDSVR_HSM_PIN`.

If you don't provide this PIN to each run-time node, you cannot log in to the KMES Series 3 and use keys that reside on the device. So, you must start the nodes with this credential. The command line argument that you should use is `-i`. You can also provide `--debug-hsm` in non-production environments to get extra HSM-related debug log messages in the server log. In this case, run the following command to start a node:

```bash expandable lines wrap title="Bash" theme={null}
$ idsvr --debug-hsm -i kmes_identity_password
```

<Note>
  Enter the password of the identity configured in the `fxpkcs11.cfg` file in the preceding command.
</Note>

<Warning>
  Warning:

  Make sure to follow all the steps in section Create a PKI container and certificate with key pair on the KMES. If any steps are skipped, Curity will fail to connect to the KMES due to missing TLS server certificate configurations (for example, the SHA-1 hash signing algorithm hasn't been selected, default approval group isn't defined, or Allow object signing hasn't been enabled), even if the key has not yet been selected for use in Curity.
</Warning>

## Use the KMES

To enable using the HSM in Curity, perform the following steps:

<Steps>
  <Step>
    Log in to the Curity admin UI and go to the **System** tab.

    <Note>
      Note: After running the command to start the Curity, the last line of the log will show you which port to connect to.
    </Note>
  </Step>

  <Step>
    Scroll down to the **Hardware Security Module** section and toggle on the HSM.

    After enabling this, you can enter information about how the run-time nodes connect to the HSM.
  </Step>

  <Step>
    Enter the file path to the Futurex PKCS #11 module in the **Library** field.
  </Step>

  <Step>
    Select slot-id in the **Slot** field and leave the **Slot ID** set to 0.
  </Step>
</Steps>

## Configure Curity TLS settings to use the server key stored in the KMES

Even without committing the changes, configuring the Futurex HSM for SSL enables you to configure keys similar to those in the HSM. To see this, perform the following steps:

<Steps>
  <Step>
    Select **Facilities** in the top-right corner of the UI.
  </Step>

  <Step>
    Go to **Keys and Cryptography** > **TLS**, and select the **+** button next to **Server SSL Keys.**

    <Check>
      Here, you have three options, including the Use from HSM option, which is impossible until an HSM is configured.
    </Check>
  </Step>

  <Step>
    Now that the HSM is configured, enter the name of the key created earlier, `Curity_Demo_1`, into the **Name** text field.

    <Note>
      Note:

      Curity uses the Java Keystore to find the private key stored in the KMES. Make sure it matches what is found in the response of the `keytool` command that was ran in the previous section.
    </Note>
  </Step>

  <Step>
    Select the **Use from HSM** option and select **\[ Next ]**.
  </Step>

  <Step>
    On the next screen, select **rsa** from the **Type** drop-down list and enter the key size used when the key was made in the HSM, namely `2048`.
  </Step>

  <Step>
    Select **\[ OK ]**.
  </Step>
</Steps>

## Assign the key

Assign the key to a run-time node by running the following steps:

<Steps>
  <Step>
    Go to the **System** tab and then go to **Deployments** in the sidebar.
  </Step>

  <Step>
    Select the name of one of the nodes you have configured to open the **Update Server** dialog box.
  </Step>

  <Step>
    The **SSL Server KeyStore** drop-down should be visible if the node uses the HTTPS protocol. From this list, select the key that you just defined.
  </Step>

  <Step>
    Select **\[ Close ]**.
  </Step>

  <Step>
    Commit the changes by selecting **Commit** from the **Changes** menu and selecting **\[ OK ]** in the **Deploy Changes** dialog box.
  </Step>
</Steps>